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Abstract — Systems health management (SHM) is an impor- 
tant set of technologies aimed at increasing system safety and 
reliability by detecting, isolating, and identifying faults; and 
predicting when the system reaches end of life (EOL), so that 
appropriate fault mitigation and recovery actions can be taken. 
Model-based SHM approaches typically make use of global, 
monolithic system models for online analysis, which results 
in a loss of scalability and efficiency for large-scale systems. 
Improvement in scalability and efficiency can be achieved by 
decomposing the system model into smaller local submodels and 
operating on these submodels instead. In this paper, the global 
system model is analyzed offline and structurally decomposed 
into local submodels. We define a common model decomposition 
framework for extracting submodels from the global model. 
This framework is then used to develop algorithms for solving 
model decomposition problems for the design of three separate 
SHM technologies, namely, estimation (which is useful for fault 
detection and identification), fault isolation, and EOL predic- 
tion. We solve these model decomposition problems using a 
three-tank system as a case study. 
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1. Introduction 

Systems health management (SHM) is a critical set of tech- 
nologies that focus on increasing system safety and reliability 
by detecting, isolating, and identifying faults; and predicting 
when the system reaches end of life (EOL), so that fault 
mitigation and recovery actions can be taken. Model-based 
SHM approaches [ 1 — 4] are usually favored over purely data- 
driven methods [5] when knowledge about the system and 
its behaviors is available. Model-based approaches typically 
make use of global, monolithic system models for online 
analysis, which results in a loss of scalability and efficiency 
for large-scale systems. 

These issues can be addressed by decomposing the global 


SHM problems into local, independent subproblems, in 
which the local results can be merged into a global result. For 
a model-based approach, this corresponds to a decomposition 
of the underlying models [6-9], Such decompositions are 
performed as offline design activities based on structural 
analysis of the global system model. 

In this paper, we propose a common model decomposition 
framework and an algorithm for structural model decompo- 
sition. We show how, through offline analysis of the global 
system model, we can solve model decomposition problems 
for three separate SHM tasks, namely, estimation (used for 
residual generation, that is usually required for fault detection 
and fault identification), fault isolation, and prediction (used 
for fault prognostics). For each SHM task, we select a specific 
approach - [10] for estimation, [7] for isolation, and [9] 
for prognostics - and demonstrate how the system can be 
decomposed using the common framework proposed in this 
paper to fulfill the needs of each approach. 

Our decomposition framework, utilizing the notion of com- 
putational causality, decomposes models into submodels by 
considering some of the variables in a model as local inputs. 
As a result, some of the unknown variables in the model 
can be computed from these local inputs, thereby resulting 
in a smaller set of equations that are decoupled from the 
rest of the system equations given these local inputs. Thus 
each submodel can be used to compute the values of its 
unknown variables independently from all other submodels. 
These independent submodels allow reasoning algorithms to 
be implemented on each submodel independently, thereby 
distributing the computation and improving efficiency. 

Specifically, this paper makes the following contributions: (i) 
we propose a formal model decomposition framework for 
defining causal models and submodels; (if) we develop an 
algorithm for designing submodels based on structural model 
decomposition; and ( Hi ) we demonstrate the usefulness of 
the model decomposition framework by applying it to model 
decomposition problems for three specific SHM functions: 
estimation, fault isolation, and prediction. Throughout this 
paper, we illustrate our model decomposition framework and 
algorithms using a three-tank system. 

This paper is organized as follows. Section 2 presents the 
model decomposition framework. Sections 3-5 demonstrate 
how this structural model decomposition framework can 
be leveraged to design submodels that are used in estima- 
tion, fault isolation, and prediction, respectively. Section 6 
presents related work, and Section 7 concludes the paper. 
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2. Model Decomposition Framework 

This section presents our framework for defining models and 
submodels and a structural model decomposition algorithm 



Qin 



that can be leveraged for efficient and scalable implemen- 
tation of different functions of SHM. We begin with the 
definition of a model. 

Definition 1 (Model) A model Ad is a tuple M. = (V, C), 
where V is a set of variables, and C is set of constraints. V 
consists of five disjoint sets, namely, the set of state variables, 
X\ the set of parameters, 0; the set of inputs, U\ the set 
of outputs, Y\ and the set of auxiliary variables, A. Each 
constraint c = (e c , V c ) £ C consists of an equation e c 
involving variables V c £ V. 


ing constraints: 
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Input variables u £ U are known or measured; and the output 
variables y £ Y correspond to (measured) sensor signals. 
Parameters 9 £ 0 include explicit model parameters that are 
used in the model constraints. 0 does not need to include all 
parameters in the equations, only those that must be included 
explicitly (e.g., for joint state-parameter estimation, as shown 
in Section 3, or fault isolation, as shown in Section 4). These 
parameters, by definition, are not computed in terms of any 
other variables, and, in this way, appear as inputs. Since the 
state variables X are, by definition, enough to describe the 
future behavior of the system, the auxiliary variables a £ A 
are not strictly needed, however, they make the model easier 
to parse, develop, and implement. 

As shown in Defn. 1, a constraint c = (s c ,V c ) includes an 
equation e c over the set of variables V c . Note that c does not 
impose any computational causality on the variables V c , i.e., 
although e c captures the information about how to compute 
a variable v £ V c in terms of all other variables in V c , the 
constraint does not specify which v £ V c is the dependent 
variable in equation s c . We write a constraint Ci = {e Cl , V Cl ) 
by its equation, e.g., as follows: 

a + b = c + d (ci) 


where for tank i, A, denotes the tank cross-sectional area, 
K, denotes the capacitance, II, denotes the resistance of 
the outflow pipe, and for tanks i and j, Rij denotes the 
flow resistance of the pipe between the tanks. Here X = 

{pi,P 2 ,P 3 }~ 0 = 0, u = {Qin}. Y = {hl,Q* 12 .Qt} 2 . and 
A = {Pl,P2,P3}- 

In order to define for a constraint c which variable v £ V c is 
the dependent variable that is computed by the others using 
the constraint, we require the notion of a causal assignment. 

Definition 2 (Causal Assignment) A causal assignment a to 
a constraint c = {s c ,V c ) is a tuple a = (c,v° ut ), where 
v ou f g j/ j s ass igned as the dependent variable in equation 

£ c . 

Unlike a constraint, a causal assignment defines a computa- 
tional causality (or computational direction) to a particular 
variable v° ut £ V c in the constraint in which it can be 
computed in terms of all other variables in V c . We write 
a causal assignment of a constraint using the constraint’s 
equation in a causal form. For example, for constraint ci 
above choosing = d: 

d := a + b — c (af) 


where V Cl = {a, b, c, d}. 

Throughout the paper, we will use a three-tank model as a 
common example. The three-tank model is representative 
of several real-world systems, such as spacecraft propellant 
loading systems [11] and fuel transfer systems of fighter 
aircrafts [12], among others. Fig. 1 shows the schematic of 
a three-tank system. For tank i £ {1,2,3}, p, denotes the 
pressure at the bottom of the tank, h t denotes the fluid height 
in the tank, and Qi denotes the volumetric flow rate out of the 
outflow pipe. For adjacent tanks i and j, Qij denotes the flow 
rate in the connecting pipe, and Q rn is the inflow into tank 1. 

Example 1: We model the three-tank system with the follow- 


where Constraint ci is rewritten with a := symbol to explic- 
itly denote that the direction of computation is from variables 
a, fo, and c to d. 

We say that a set of causal assignments A. for a model Ai is 
valid if 

• For all v £ U U O, A does not contain any a such that 
a = (c, v), i.e., U and 0 are not computed in terms of any 
other variables. 


2 We name output variables with an asterisk so as to not confuse the measured 
variables from unmeasured versions of them that may be used as state or 
auxiliary variables. 
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• For all v £ Y, A does not contain any a = (c, v° ut ) where 
v £ V c — {v° ut }, i.e., no variable is computed in terms of 
any y £Y. 

• For all v £ V — U — 0, A contains exactly one a = (c, v), 
i.e., other than the variables in U and 0, every variable 
must have exactly one constraint to compute it. 

A causal model is a model extended with a valid set of causal 
assignments. 

Definition 3 (Causal Model) Given a model Ad* = ( V. C), a 
causal model for Ai* is a tuple Af = ( V , C, A), where A is 
a set of valid causal assignments. 


Example 2: The causal assignments for the three-tank model 
introduced in Example 1 are as follows: 
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Here, we assume integral causality, i.e., state variables are 
computed via integration. 


For the purposes of visualizing a causal model, we represent 
A4 using a directed graph Q = (V, £), where V is the set 
of vertices corresponding directly to the variables V in Ai, 
and £ is the set of edges, where for every (c, v° ut ) £ A, we 
include an edge (V, v° ut ) for each v' £V C — {v° ut }. 

Example 3: Fig. 2 shows the causal graph for the three- 
tank system of Example 1 with Y = {h^, Ql 2 , Q%}- State 
variables are denoted using dashed boxes, output variables 
are denoted using solid-lined boxes, and input variables are 
denoted using dashed circles. 


Given a model, we are interested in generating submodels that 
allow for the computation of a given set of variables using 
only local inputs. Given a definition of the local inputs (in 
general, selected from V) and the set of variables we wish to 
be computed by the submodel (selected from V — U — 0), 
we create from a causal model Ad a causal submodel Ai , . 
We obtain a submodel in which only a subset of the variables 
in V are computed using only a subset of the constraints in 
C. In this way, each submodel computes its variable values 
independently from all other submodels. A submodel can be 
defined as follows. 



Figure 2. Causal graph of three tank system with Y = 

{K,Q* 12 ,Q* 3 }. 


Definition 4 (Causal Submodel) A causal submodel AT; of a 
causal model Ad = (V, C. A) is a tuple A 1; = (V;, (7;, Ai), 
where Vi C V, Ci C C, and A t is a set of (valid) causal 
assignments for Ai - L . 

Note that, in general. A, is not a subset of A, because 
since we allow to select local inputs from Y, these vari- 
ables become local inputs, i.e., appear in (7;, and the causal 
assignment in A that computes these variables is changed 
to a form where some other variable in the corresponding 
constraint is selected as the dependent variable. As a result, 
these causal assignments will be different, but the rest of the 
causal assignments in A t will still be found in A. 

The procedure for generating a submodel from a causal model 
is given as Algorithm 1. Given a causal model Ai, a set 
of variables U* D U that includes the input variables in 
A4 as well as some other variables previously not in U that 
are considered as local inputs, and a set of variables to be 
computed V* , and a preferences list, P (explained below), the 
GenerateSubmodel algorithm derives a causal submodel 
Adi that computes V* using a subset of U*. 

In Algorithm 1, the queue, variables, represents the set of 
variables that have been added to the submodel but have not 
yet been resolved, i.e., they cannot yet be computed by the 
submodel. This queue is initialized to V*, the set of variables 
that must be computed by the submodel. The algorithm then 
loops until this queue has been emptied, i.e., the submodel 
can compute all variables in V* using only variables in 
U*. Within the loop, the next variable v is popped off the 
queue. We then determine the best constraint to use to resolve 
this variable with the GetBestConstraint subroutine 
(Subroutine 2). We add the constraint to the submodel and the 
causal assignment for the constraint in the form that computes 
v. We then need to resolve all the variables being used to 
compute v, i.e., all its predecessors in the causal graph. Each 
of these variables that have not already been visited (not 
already in Vf), are not parameters (not in 0), and are not local 
inputs (not in U *) must be resolved and so are added to the 
queue. Then the variables are added to the submodel and the 
loop continues until the queue is emptied. 

The goal of the GetBestConstraint subroutine is to find 
the best constraint to resolve v. The subroutine constructs 
a set C that is the set of constraints that can completely 
resolve the variable, i.e., resolves v without further backward 
propagation (all other variables involved in the constraint are 
in Vi U 0 U U*), and then chooses the best according to 
a preferences list P. If no such constraint exists, then the 
constraint that computes v in the current causal assignment is 
chosen, and further backward propagation will be necessary. 
Here, we are preferring minimal resolutions of v, i.e., those 
that do not require backward propagation, because then the 
submodel will be minimal in the number of variables and 
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Algorithm 1 Ai; = GenerateSubmodel(Al, U* , V*, P ) 

1 : V <- V* 

2: Ci^0 

3: Ai <- 0 

4: variables <— 17* 

5: while variables ^ 0 do 

6: v <— pop (variables) 

7: c <— GetBestConstraint(v, Vi, U*,A, P) 

8: Ci^Ci U {c} 

9: A <- A; U {(c, v)} 

10: for all v' € V do 

11: if v ^ Vi and v' £ 0 and o' ^ (7* then 

12: variables <— variables U {r/} 

13: end if 

14: Vi ^ Vi U {o'} 

15: end for 

16: end while 
17: Mi<-{Vi,Ci,Ai) 


constraints needed to compute V*. 

In general, a variable v is involved in many constraints, 
however, exactly one of these constraints, in the given causal 
assignment, computes v. If this constraint does not com- 
pletely resolve v, we find the constraints in which v is used 
to compute some output variable y £ Y fi U*. We consider 
modifying the causal assignment so that such a y (used now 
as an input) is used to compute v, instead of v being used 
to compute y. This can only be performed if, for the causal 
assignment in which y is being used to compute v, all other 
variables involved in the constraint are in V U 0 U U*, 
in which case this constraint in this new causal assignment 
can completely resolve v. If no constraint can be found 
that completely resolves v, then the constraint that in the 
current causal assignment computes v will have to be used, 
and backward propagation will be necessary. Otherwise, we 
select the most preferable constraint that completely resolves 
v. Preference among constraints (in which an output would 
be transformed to an input) is computed using a preferences 
list P, that contains a partial ordering of all the outputs in the 
model of the form y, < yj, meaning that y :l is preferred over 
y, . The subroutine goes through every pair of constraints and 
removes from the list of most preferable constraints, C', any 
constraint that uses a measured variable that is less preferable 
to one involved in another constraint. Of those remaining, 
an arbitrary choice is made. The preferences list can be used 
to prefer measured variables with less noise over those with 
more noise. 

Example 4: For the three-tank model (Fig. 2), say that we 
select U* = {Q in ,ht,Qt 2 } and V* = {Qg}, and P = 
{(<3*2 ^ ) } • Algorithm 1 starts with V t = Q3, and 

propagates back to p 3 , and adds it to l ',. From p 3 it propagates 
back to p 3 , adding it to V, . Of the predecessors of p 3 , p 3 is 
already in Vi, so is not added to the variables queue, and p 2 
is not, so the algorithm propagates back to p 2 , adding it to V, . 
At this point, there are two constraints to consider to possibly 
compute p 2 : (i) the constraint C3 with causal assignment a 3 
that computes p 2 from p 2 , or (ii) the constraint eg with causal 
assignment erg, set to have the new causal assignment 

P ‘2 '■= Pi — Q12 ' P12 , (an) 

that computes p 2 from p-\ and <3{ 2 - In an, pi is required but 
is not yet included in V, so this constraint cannot completely 
resolve p 2 and we default to using causal assignment <33, 
propagating back to p 2 and from there to p\ (p 2 and p 3 
are already in Vi). Now, at p \ , we have three constraints 


Subroutine 2 c = Get Best Constraint^, Vj ,U*,A,P) 
1: C <- 0 

2: c v <— find c where (c, v) G A 

3: if V Cv C V, IJ U * then 

4: C<^CU{c t ,} 

5: end if 

6: for all y e Y Cl U* do 

7: c y t — find c where (c, y) £ A 

8: if v G V Cy and V Cy Chut/* then 

9: C<-CU {c y } 

10: end if 

11: end for 
12: if C = 0 then 

13: c t — c v 

14: else if c v £ C then 

15: C i — C v 

16: else 
17: C 

18: for all ci, C 2 £ C where ci / C 2 do 

19: yi t— find y where (ci , y\ ) £ A 

20: i /2 t- find y where (c 2 , 2 / 2 ) G A 

21: if (i/i <1 1 / 2 ) G P then 

22: C' C' - {ci} 

23: end if 

24: end for 

25: c <— f irst(C' / ) 

26: end if 



Figure 3. Causal graph for the minimal submodel of the 
three-tank system computed when U* = {Qi n , h*, Qt 2 }, 
V* = {Q5I and P = { (Qi 2 < h*)}. 


to consider that may resolve p-[ : ( i ) the constraint c 2 with 
causal assignment a 2 that computes pi from p 3 , (ii) the 
constraint eg with causal assignment o 9 , set to have the new 
causal assignment 


Pi P2 + Q 12 ‘ -R12 (0:12) 

that computes pi from Ql 2 and p 2 , and (Hi) the constraint c 3 
with causal assignment as, set to have the new causal assign- 
ment 


Pi := 


hi ■ Aj 

Ki 


(ctl3) 


that computes pi from hi . Since the preferences list P prefers 
hi over Q\ 2 , the algorithm chooses to compute pi using 
causal assignment 0:13. The graph for the resultant submodel 
is shown in Fig. 3. 


The algorithm generates complete submodels, i.e., the sub- 
models contain at least the variables needed to compute its 
V*. This is guaranteed because the algorithm only stops 
propagation at variables included in V U 0 U U*. Since 
U* A U, given a particular U* and V*, there may be 
multiple submodels that can compute V* using U * , with the 
global system model always being an option. The goal of the 
decomposition algorithm is to generate minimal submodels, 
i.e., submodels with the minimal number of constraints (and 
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hence, state variables) needed to compute V* using U* . 
It is possible for nonminimality to be obtained when the 
GetBestConstraint subroutine could have resolved a 
constraint by searching in the forward causality direction 
more than one constraint ahead. For example, a variable 
v can be resolved if an output is computed from a single 
auxiliary variable that is computed only from v, however 
GetBestConstraint would ignore such a possibility. 
The algorithm can be extended to handle such a situation, 
although at a loss of efficiency, but that is beyond the scope 
of this work. However, the simpler solution is to structure 
the auxiliary variables to avoid such circumstances, e.g, when 
minimality is a requirement the auxiliary variables can be 
discarded to ensure minimality. 

In the worst case, the algorithm must visit all variables and 
constraints. On each variable. Subroutine 2 is called, which 
in the worst case considers all variables in Y IT U*. So, the 
overall worst-case time complexity is 0 ((|Vj + \E\) ■ \ Y (T 
U* |). Since (YnU*) C V, the algorithm is polynomial in the 
model size. On average, some amount of decomposition will 
be possible so the complexity will be much lower in practice. 

In the following sections, we show how this model decompo- 
sition approach can be applied to the problems of estimation, 
fault isolation, and prediction. 


3. Model Decomposition for 
Estimation 

Estimation in the SHM context can be used for three main 
purposes, namely, for fault detection (through residual gen- 
eration), fault identification, and systems health state esti- 
mation. The three different purposes require the estimation 
problem to be posed somewhat differently. For example, for 
fault detection, the estimation problem involves estimating 
the value of measured variables (based on estimated values 
of state variables) and comparing these estimates to actual 
measured values to generate residual signals. For fault 
identification, a set of parameters associated with faults are 
estimated. Finally, for system health state estimation, joint 
estimations of hidden state and unknown parameter variables 
are computed. In general, the estimation problem is to 
generate a probability distribution p(X, 0| Y). 



Figure 4. Causal graph of three tank system with Y = 

{h{,h* 2 ,h* 3 }. 


[ 10 ], for fault identification as in [ 10 , 13 ], and for systems 
health state estimation [ 8 ], 

Example 5: As an example, consider the three -tank model 
with Y = [h*. h* 2 , h 3 } that is given by constraints C2-C8 and 
the new constraints 


K = 


h* 3 = 


P2 ■ K 2 
A 2 

P3 ' K 3 

As 


(Cu) 

(C12) 


with the causal assignments 02-Os and the additional causal 
assignments: 


K 
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P2 ■ I < 2 

A-2 

P3 ' K 3 
-4,3 


(ct 14) 
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Fig. 4 shows the causal graph for the three -tank system with 
the selected outputs. Here, X = {pi,P2,P3}, 0 = 0, Y = 
{ h \ , h 2 , h 3 } , U = {Q in }, and A = {pi,p 2 ,p 3 }- We gener- 
ate three minimal submodels, one for each measurement. For 
the first minimal submodel, we select U* = 
and V* = {/it}, for the second one U* = \Qim h*, h 3 \ 
and V* = {h^}, and for the third one U* = { Qi n , h*, h 2 \ 
and V* = { h 3 } . The minimal submodels computed by 
Algorithm 1 for this example include: for V* = { h \ } . 
constraints with causal assignments a. 2 , 05, as, and 


The advantage of model decomposition for estimation is that 
the global system model is partitioned into minimal sub- 
models, which can be implemented in a distributed fashion, 
obtaining robust and efficient online estimation solutions as 
compared to estimation using the global system model. Each 
local estimator i computes p(Xi , 0i|lj). Due to the decou- 
pled nature of the submodels, the local estimation problems 
can be defined independently of each other, and the local 
estimators do not need to communicate. This is in contrast 
to other distributed estimation schemes in which local esti- 
mators communicate state estimates among one another. 

The model decomposition framework proposed in this paper 
can be used to derive minimal estimator submodels from the 
global system model. Each minimal estimator will take a 
subset of the system inputs, U, and the system outputs, Y, 
to compute an estimate of measured variables, Y, . So, the U* 
and V* sets for this decomposition problem are formed as 
U* = U U (Y — {Tj}) and V* = Y. t . To define a set of local 
estimators, we typically create one for each y € Y, where 
V* = Yj = { y } . In previous works, we have used minimal 
estimation submodels for tracking and fault detection as in 


P 2 ■= 


h 2 ■ A 2 
I<2 


{Ot 16 ) 


derived from the constraint Cn with the causal assign- 
ment «i4 (see Fig. 5 a); for V* = {h 2 }, constraints with 
causal assignments a 3 , ag, 043, 044, and 


P3 ■= 


K ■ ^3 

K 3 


(0:17) 


derived from the constraint C12 with causal assignment 045 
(see Fig. 5 b); and for V* = {/13}, constraints with causal 
assignments a±, ar, a±e, and 047 (see Fig. 5 c). Note that 
constraints and variables can be included in several submod- 
els. 


Example 6: As a second example, consider the model shown 
in Fig. 2 (Y = {/i*, Ql 2 , Q3}), using causal assignments a 3 - 
ct4o an d P = {(/14 <1 0i2)}- F° r ^is example, we also com- 
pute three minimal submodels, one for each measurement. 
The minimal submodels computed for this example are: for 
V* = {(1]}, constraints with causal assignments 02, 05, a%. 
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(a) Causal graph for h * submodel. 



(b) Causal graph for h J submodel. 



(c) Causal graph for /ij sub- 
model. 


Figure 5. Causal graphs for minimal submodels for estima- 
tion of the three -tank system when Y = }. 


and an (see Figure 6a); for V* = {Ql 2 }- constraints with 
causal assignments a 3 , a 6 , ag, ai3, and 

P3 ■= Qt ■ R 3 (ais) 

derived from constraint with causal assignment aio (see 
Figure 6b); and for V* = {Q|}, constraints with causal 
assignments a 3 , a§, 0:4, ay, aio, and a 3 2 (see Figure 6c). 
Note that using the preferences P from Example 4 we would 
have obtained the submodel whose causal graph is shown 
in Fig. 3. Compared to the previous example, where every 
submodel has only one state variable, in this example, the 
submodel for V* = {Q|} includes state variables p 2 and p 3 . 


4. Model Decomposition for Fault 
Isolation 

Model decomposition can also be used for the purposes of 
fault isolation [1,6]. Here, residual generators are formed 
from the submodels, and the advantage of model decom- 
position is that each residual generator will be sensitive to 
only the faults in the corresponding submodel. As a result, 
diagnosability is improved [14]. In our approach, we attempt 
to design local diagnosers based on the submodels that can 
independently, without communication, generate globally 
correct fault isolation results [7], 

For a given system model A4, we define a set of faults 
F. In this work, we assume that this set of faults can be 
represented as abrupt, persistent changes in the parameters 



(a) Causal graph for h\ submodel. 


1 ' r — ' 1 ' 
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(b) Causal graph for Q] 2 submodel. 



(c) Causal graph for Q 3 submodel. 


Figure 6. Causal graphs for minimal submodels for estima- 
tion of the three-tank system when Y = {h\, Ql 2 , Q3} anc * 

p = m<Qh)}- 



Figure 7. Causal graph of the three tank system including 
fault parameters. 


0 of the system model. For a given fault isolation algorithm 
and output set Y, distinguishability of a fault /) from another 
fault fj refers to the notion that the isolation algorithm can, if 
f, occurs, eliminate f t from consideration. We denote this as 
/, ooy fj. Diagnosability is generally defined as follows. 

Definition 5 (Diagnosability) A model M. with faults F and 
outputs Y is diagnosable with a given fault isolation algo- 
rithm if and only if (V/, : , f :j G F)f, ^ f : ■ => /,; * Y fj- 

Example 7: As an example, consider the three -tank model 
where tank heights are measured (see Example 5 in Sec- 
tion 3). In this case, we make the system parameters explicit, 
so 0 = {K 1, Ri, R 12 , K 2 , R 2 , R- 23 , K 3 , R 3 }, and consider 
faults that are represented as increases in the resistances 
and decreases in the capacitances (denoted using K~ , Rf , 
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and Rfj)- The causal graph for this model is shown in 
Fig. 7. As the fault isolation algorithm we use the QED 
(Qualitative Event -based Diagnosis) approach [15, 16], In 
this approach, for each fault we generate a list of symbolic 
fault signatures, representing magnitude (first symbol) and 
slope (second symbol) changes in the residuals associated 
with measurements [ 2 ] (where + indicates an increase, - 
indicates a decrease, and 0 indicates no change), and relative 
measurement orderings, representing the sequential order 
of residual deviations within a submodel in response to a 
fault [15]. Table 1 shows the signatures and orderings for 
the three-tank system. Here, r y refers to the residual for 
output y, and an ordering r yi -< r y2 means that r yi will 
deviate before r y2 . Also, a + superscript indicates an increase 
and a " superscript indicates a decrease in the parameters. 
This model is diagnosable because for each pair of faults, the 
combination of signatures and orderings is different. 


Fault rh* rn% rh* Measurement Orderings 


Kf 

+ - 

0 + 

0 + 

r hi 

-< 

Th 2 

,r hl 

-< 

rh 3 

,r h 2 

-< 

r h. 

Rf 

0 + 

0 + 

0 + 

r hl 

-< 

rh 2 

>r hl 

-< 

rh 3 

,r h 2 

-< 

rh : 

R-12 

0 + 

0- 

0- 

r h 2 

R 

r h 3 







K 2 

0 + 

+- 

0 + 

r h 2 

A 

r h 1 

,r h 2 

-< 

r h 3 




Rf 

0 + 

0 + 

0 + 

Th 2 

-< 

Vh 1 

,r h 2 

-< 

r h 3 




Rfi 

0 + 

0 + 

0- 

rh 2 

-< 

rh 1 







K 3 

0 + 

0 + 

+- 

r h 2 

-< 

rh 1 

>r h 3 

-< 

r hl 

>r h 3 

-< 

Vh- 

Rf 

0 + 

0 + 

0 + 

r h 2 

-< 

rh 1 

>r h 3 

-< 

r hl 

-r h 3 

-< 

rh- 


Table 1 . Fault signatures and relative measurement 
orderings for the global model of the three-tank system. 


We split Ml into submodels Ml,. We partition the fault set F 
into subsets F t , one for each submodel. We are interested in 
the property of global diagnosability [17]. 

Definition 6 (Global Diagnosability) A submodel AT; of 
model Ml, with faults F t C F, is globally diagnosable with 
a given fault isolation algorithm if (V/; £ Fi, fj £ F)fi ^ 
fj =*• fi't'Yi fj- 

In other words, a submodel is globally diagnosable if the fault 
isolation algorithm can distinguish all local faults (in F,) from 
all other possible faults (both local and nonlocal, i.e., in F) 
using only its local outputs. If a local fault occurs, then the 
fault isolation algorithm will know exactly the fault (because 
it is distinguishable from all other local faults). If a nonlocal 
fault occurs, the algorithm will know only that the fault is 
not local (since all local faults are distinguishable from all 
nonlocal faults). If we design the submodels such that they 
are all globally diagnosable for their given F, and Y, then we 
guarantee that the local fault isolation results will be globally 
correct. When a fault occurs, exactly one local diagnoser will 
know exactly the fault and all other diagnosers will know the 
fault is nonlocal. 

Example 8: Consider still the three -tank system where 
heights h\, h 2 , and h 3 are measured. We partition the fault 
sets into F- t = {Kf , Rf , i?+ 2 }, F 2 = {K 2 , Rf, -R 23 }, 
and F 3 = { Kf , lit } . Consider Ml\ created using U* = 
U U {h 2l h 3 } and V* = {/i[}, so the only residual will be 
hi. As observed in Table 1, the submodel is not globally 
diagnosable, because Rf and Rf 2 both produce 0+ (smooth 
increase) on r> ( * . Consider now Ml\ created using U* = 
U U {/ 13 } and V* = {hl,h 2 }. Now, faults not in F\ are 


Algorithm 3 Globally Diagnosable Submodel Design 

Input: § = {5, = (Fi, W, Mi) : i = 1, . . . , n}, M. P 

for all Si £ S do 

while Si not globally diagnosable do 

S y <- 0 

for all y £ V - Yi do 

Yf <- Yi U {y} 

Ml <— GenerateSubmodel (M,U U (Y — 
Y/),Y/,P) 

SI «- (Fi,Yl,M'f) 

end for 

Si <— arg min GD(F, S[) 

s'ss 

end while 
end for 


included in the submodel (namely, Kf , IF, , R 23 ), so they in 
addition to the local faults (in F\ ) may affect the residuals. 
If we do not consider measurement orderings, the submodel 
is not globally diagnosable, because a local fault, Rf, and 
a nonlocal fault, Rf, produce the same effects on the two 
residuals, r> ( * and ij,- . If we do consider measurement 
orderings, however, the submodel is globally diagnosable, 
because although we observe the same effects on the residuals 
for those two faults, the effects appear in a different temporal 
sequence (Rf affects ry* first whereas Rf affects ry* first). 

An algorithm for designing globally diagnosable submodels 
is shown as Algorithm 3 (generalized from [7]). An initial 
submodel design is given, in which for Y,, the submodel is 
defined as Ml, = GenerateSubmodel(Al, U U (Y — 
Yi),Yi, P), where P is the (given) set of preferences. The 
fault set partition and initial measurement sets are provided 
by the user. We denote the tuple ( F, , V’ . Ml,) using S, . Here 
we define a function GD(F, S,) that returns the number of 
faults in F, that are not globally distinguishable from those in 
F. 

The algorithm implements a greedy solution that works as 
follows. For each submodel, we try adding one new output 
at a time until the submodel becomes globally diagnosable. 
For each new output that we try to add, we determine how 
much it improves the global diagnosability (using GD ), and 
whichever one improves it the most (by minimizing GD) is 
added. We then continue by trying to find the next best output 
to add. This loop completes when global diagnosability 
is attained, which in the worst case will occur when all 
outputs are added. This assumes that the global model is 
diagnosable; if it is not, then we can group indistinguishable 
faults as a single aggregate fault [17] to make the system 
diagnosable (a diagnosis of the aggregate fault is interpreted 
as an ambiguity between the indistinguishable faults). If the 
worst case is achieved, this essentially means that the fault 
isolation problem is not decomposable for the given model, 
fault set, and fault isolation algorithm. 

Example 9: Consider again the scenario given in Example 8 , 
where the tank heights are measured and the fault set is par- 
titioned into Fi = {Kf , R+ , Rf 2 }, F 2 = {K 2 , R 2 , R 23 }. 
and F 3 = {K 3 , R 3 }. We create Ml\ using Yi = {ft-i}. Ml 2 
using Y 2 = {h 2 }, and Ml 3 using Y 3 = {hi}. Applying the 
design algorithm, we find that the first submodel is extended 
to include h 2 , the second is extended to include h 3 , and the 
third does not need to be extended. The corresponding causal 
graphs are shown in Fig. 8 . As discussed in Example 8 , Adi 
is not diagnosable using only Yi = { hf }. The case is similar 


7 




(a) Causal graph for isolation submodel for {K 1 , U ] , If, }. 


The desired performance is expressed through a set of n c con- 
straints, Ceol = {Ci}£ lt where c,; describes the mapping 
of a given point in the joint state-parameter space given the 
current inputs to a variable e* € {0, 1}, where 1 means the 
performance requirement is satisfied and 0 means it is not sat- 
isfied, and we say the system has no useful life remaining. In 
model-based prognostics [ 3 ], the system model is augmented 
to include these constraints, i.e., for M = ( V,C), Ceol C C 
and the e, variables are included in V (as auxiliary variables 
in A). The causality of these constraints is always fixed 
such that for constraint c*, the causal assignment takes the 
following form: 



(b) Causal graph for isolation submodel for 
{Kf,R+, R+ 3 }. 



(c) Causal graph for isolation 
submodel for {Kf , R.\ }. 


Figure 8. Causal graphs for isolation submodels for the 
three-tank system. 


for Mi, which is not diagnosable using only Y 2 = {hf}. 
However, M3 using Y3 = {/13} is globally diagnosable, 
because Kf and ft’J produce different effects on 77,- , and 
there are no nonlocal faults included in the submodel (see 
Fig. 8c). For M\, if we add h\ (Fig. 8a), in which Rf, 
Rfj produce different effects, the submodel now becomes 
globally diagnosable (as discussed in Example 8). For M2, 
if /13 is added the case is similar and the submodel becomes 
globally diagnosable. 


5. Model Decomposition for 
Prediction 

In the context of SHM, prognostics deals with predicting the 

time at which a component, subsystem, or system will no 

longer satisfy desired performance constraints. For example, 
we may want to predict when a battery will discharge [ 18 ], 
when a valve will no longer open within required time lim- 
its [ 19 ], or when a crack grows to an unacceptable size [ 20 ]. 
The time at which this event occurs is known as end of life 

(EOL) and the time until that point is known as remaining 
useful life (RUL). 


e, := fa{vi,V2, ■ ■ ■ ,v m ), (a 19 ) 

where {iq, V2, • ■ • , v rn } = V Cl , and f c . is a function evaluat- 
ing the performance requirement. 

These individual constraints may be combined into a single 
system-level threshold function Teol '■ K™ 1 x K™ 5 * * * 9 x R n “ — > 
B, defined as 

T EOL (x{t),0(t),u(t)) = 

(i, 0 e {/ Ci (x(f),0(f),u(f))}^ 1 

1 ^0, otherwise. 

That is, Teol evaluates to 1, i.e., the system has reached 
an unacceptable region of behavior, when any one of the 
constraints are violated. EOL is then defined as 

EOL[t P ) = 

inf{t € R : t > t P A T E oL(x(t),0(t), u(t)) = 1}, 

i.e., EOL is the earliest time point at which Teol is met 
(evaluates to 1 ). RUL is expressed using EOL as 

RUL(t P ) = EOL{tp) — t P . 

Example 10 : Consider the three -tank system given by causal 
assignments o^-or as well as the following causal assign- 
ments: 


Pi 

• Ty r ( Qin Ql Ql2 ) 
& 1 

(a 20) 

P 2 

:= TT {Q12 — Q2 — Q23) 
E2 

(a 21) 

P 3 

'■= TT ( Q23 - Q3) 
E 3 

(a 22) 

Ql 

Ft 

Ri 

(fit 23) 

q 2 

P 2 

' R2 

(0:24) 

Q3 

P 3 

’ Ri 

(a 25) 

Q 12 

pi - Pi 
:= U12 — — 

J.^ T-) 

(«26) 

Q23 

P 2 ~P 3 
■= u 23 p 

^23 

(0:27) 


Here, u 12 and u 2 3 are the positions of valves on the connect- 
ing pipes. Note also that we include auxiliary variables for the 
flows out of and between the tanks. The model is augmented 









with the EOL constraints and the associated variables: 


et 

= (P 1 > P~) 

(OJ28) 

e -2 

= (P2 >P~) 

(Ct29) 

e 3 

= (P3 >P~) 

(C»:30) 


where p is the minimum allowable tank pressure. Here, 
X = {pi,P2,P 3 }, © = 0 , U = {Qin,Ui2,U2 3 }. Y = 0, 
and A = {pi,p 2 ,p 3 ,ei,e2,e 3 }. The corresponding causal 
graph is shown in Fig. 9 . 



(a) Causal graph for prediction submodel for 
ei. 


By decomposing the global model into local submodels, we 
can decompose the prediction problem [ 9 ], For each c £ 
Ceol , we create a local submodel that can evaluate that 
constraint. Since Teol is reached when any single c £ 
Geo l is violated, this time point can be computed by taking 
the minimum of the local EOLs corresponding to the local 
performance constraints. For decomposition, we must define 
a set of local inputs. For prediction, the set of available local 
inputs is denoted as Up C V. Here, Up is a set of variables 
whose future values (or a distribution of future values) can be 
hypothesized. Note that since we do not have access to future 
sensor readings, V does not include any output variables. 

The submodels are generated as follows. For each c £ Ceol, 
we set M. c <— GenerateSubmodel(A / l, Up, v c , 0). 
(Here, the preferences list P is not needed since there are 
no outputs.) 

Example 11 : To perform prediction in the three-tank system, 
we need to assign some variables to be in Up, the set of 
variables that can be predicted a priori. First, assume that 
Up consists of only U, which in this case is {Qi n , u 3 2, U23}. 
We generate three submodels, one for each EOL constraint. 
Using the decomposition algorithm for the prediction prob- 
lem, we find we cannot decompose the global model. 3 To 
compute any single pressure we need to compute also the 
other pressures. That is, each submodel has constraints 
with causal assignments 012-0:4 and 020-0:27 with the EOL 
constraint for that submodel. In this case, it makes sense to 
simply use the global model (shown in Fig. 9 ) to compute all 
three constraints. 



(b) Causal graph for prediction submodel for 

e2- 



(c) Causal graph for prediction 
submodel for e%. 

Figure 10. Causal graphs for prediction submodels for the 
three tank system. 


028- Similarly, the second submodel has only the constraints 
for the second tank, and the third submodel has only those for 
the third tank. The corresponding causal graphs are shown in 
Fig. 10 . 


Example 12 : Now assume that the valves on the connecting 
pipes are controlled so as to always ensure a constant desired 
flow through them. In this case, because Q12 and Q23 are 
controlled to a known value, their values are known a priori 
and they can be used as local inputs. So, here. Up = 
UU{Qi2, <523}- Now, the decomposition algorithm generates 
three submodels without overlap. The first submodel uses 
Qi n and Q 12 as local inputs, and includes 012, a 20, & 23 and 


f When U* n Y = 0, Algorithm 1 simplifies significantly, because in 
Subroutine 2, there is only ever one constraint to consider, which is the one 
that in the current causal assignment computes the variable v. 


6. Related Work 

Several techniques have been proposed for off-line system 
model decomposition in model-based diagnosis: Analyti- 
cal Redundancy Relations (ARRs) [ 21 ], Possible Conflicts 
(PCs) [ 6 ], Potential Conflicts [ 22 ], Minimal Structurally 
Overdetermined sets of equations (MSOs) [ 23 ], among oth- 
ers. All of them are capable of finding the whole set of 
overdetermined equations in the system model, thus con- 
taining enough redundancy to perform fault detection and 
isolation. The main difference between these approaches 
comes in the usage of causality information. ARRs and 
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MSOs consider only structural information, i.e., relations 
between equations and variables in the model. Possible 
Conflicts introduce causal information and thus identify those 
submodels that could be computed. The four approaches have 
been compared in [24], finding out that they are equivalent 
from a structural point of view. Once causality is introduced, 
the equivalence can be extended to minimal conflicts [25], 
which is an on-line technique for computing the source of 
actual discrepancies in a system, which also induces a model 
decomposition. 

The approach presented in this paper is more similar to the 
Possible Conflicts approach than the ARRs and MSOs ap- 
proaches, since we perform the decomposition by assuming 
a causal assignment in the model. However, important dif- 
ferences arise between the proposed framework and the PCs 
approach. The most important is related with the applicability 
of our generalized framework to solve different SHM prob- 
lems. While PCs only decompose the system model into min- 
imal submodels for estimation, isolation, and identification 
purposes, our generalized framework also allows to generate 
minimal submodels for prediction. Also, since we base our 
decomposition process on a causal model, the algorithm pre- 
sented here is much more efficient to decompose the problem 
than the PCs algorithm, which computes evaluable models 
for all potential causality assignments. Another important 
difference is the existance and the usage of P, which can be 
used to drive the decomposition process and does not exist 
in the PCs approach. Also, our approach generates multi- 
output submodels, while the PC-based algorithm generates 
only single-output submodels. 

Other approaches have been proposed in the literature for 
structural model decomposition, but all of them have been 
developed to provide submodels for a particular SHM func- 
tion. For example, Williams and Millar presented Moriarty 
[26], an approach for decomposing a system model into 
smaller hierarchically organized subsystems. Their decom- 
position approach generates minimal subsets of equations for 
estimation from a system mode, and has been applied for 
parameter estimation, but cannot be used to generate isolation 
and prediction submodels. Lunze and Schiller [27] presented 
an approach that, similar to our proposal, uses causal graphs 
associated to over-constrained systems, however, their ap- 
proach has only been applied to perform fault diagnosis. 
More recently, Nyberg [28] proposed a general framework for 
model-based diagnosis based on structural hypothesis tests, 
which could be considered as a generalization of structural 
analysis in the decision theory field. 


7. Conclusions 

In this paper, we presented a general model decomposition 
framework, and showed how the concept of model decom- 
position is pervasive to different SHM methodologies, such 
as estimation, fault isolation, and prediction. We described 
the role that model decomposition plays in three specific 
approaches to estimation, isolation, and prediction, and pre- 
sented how the different model decomposition problems for 
these different approaches can be solved within our common 
framework. 

Our model decomposition framework assumes that a single 
causal assignment exists to the global model that leads to 
a model that can be implemented and simulated, assum- 
ing integral causality. Future work will address derivative 
causality and algebraic loops. In hybrid systems, the causal 


assignment can change depending on the system mode, and 
future work will deal with this aspect as well. Another impor- 
tant consideration for model decomposition when applied to 
estimation and fault isolation, as shown in those sections, is 
that the quality of the decomposition depends on the available 
sensors. Therefore another design aspect is choosing the right 
set of sensors to get the best model decomposition. We will 
consider also the extension to the decomposition algorithm to 
handle auxiliary variables more generally as discussed at the 
end of Section 2. 
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